Received December 27, 2018, accepted January 3, 2019, date of current version April 11, 2019.

Digital Object Identifier 10.1109/ACCESS.2019.2895334

Deep Learning Approach for Intelligent Intrusion

Detection System
R. VINAYAKUMAR 1 , MAMOUN ALAZAB2 , (Senior Member, IEEE), K. P. SOMAN1 ,
PRABAHARAN POORNACHANDRAN3 , AMEER AL-NEMRAT4 ,
AND SITALAKSHMI VENKATRAMAN5
1 Center for Computational Engineering and Networking, Amrita School of Engineering, Amrita Vishwa Vidyapeetham, Coimbatore 641112, India
2 College of Engineering, IT & Environment, Charles Darwin University, Casuarina, NT 0810, Australia
3 Centre for Cyber Security Systems and Networks, Amrita School of Engineering, Amrita Vishwa Vidyapeetham, Amritapuri, India
4 School of Architecture, Computing, and Engineering, University of East London, London E16 2RD, U.K.
5 Department of IT, Melbourne Polytechnic, Prahran Campus, Melbourne, VIC 3181, Australia

Corresponding author: R. Vinayakumar (vinayakumarr77@gmail.com)

This work was supported in part by the Paramount Computer Systems, in part by the Lakhshya Cyber Security Labs, and in part by the
Department of Corporate and Information Services, Northern Territory Government of Australia.

ABSTRACT Machine learning techniques are being widely used to develop an intrusion detection sys-
tem (IDS) for detecting and classifying cyberattacks at the network-level and the host-level in a timely
and automatic manner. However, many challenges arise since malicious attacks are continually changing
and are occurring in very large volumes requiring a scalable solution. There are different malware datasets
available publicly for further research by cyber security community. However, no existing study has shown
the detailed analysis of the performance of various machine learning algorithms on various publicly available
datasets. Due to the dynamic nature of malware with continuously changing attacking methods, the malware
datasets available publicly are to be updated systematically and benchmarked. In this paper, a deep neural
network (DNN), a type of deep learning model, is explored to develop a flexible and effective IDS to detect
and classify unforeseen and unpredictable cyberattacks. The continuous change in network behavior and
rapid evolution of attacks makes it necessary to evaluate various datasets which are generated over the
years through static and dynamic approaches. This type of study facilitates to identify the best algorithm
which can effectively work in detecting future cyberattacks. A comprehensive evaluation of experiments of
DNNs and other classical machine learning classifiers are shown on various publicly available benchmark
malware datasets. The optimal network parameters and network topologies for DNNs are chosen through the
following hyperparameter selection methods with KDDCup 99 dataset. All the experiments of DNNs are run
till 1,000 epochs with the learning rate varying in the range [0.01–0.5]. The DNN model which performed
well on KDDCup 99 is applied on other datasets, such as NSL-KDD, UNSW-NB15, Kyoto, WSN-DS, and
CICIDS 2017, to conduct the benchmark. Our DNN model learns the abstract and high-dimensional feature
representation of the IDS data by passing them into many hidden layers. Through a rigorous experimental
testing, it is confirmed that DNNs perform well in comparison with the classical machine learning classifiers.
Finally, we propose a highly scalable and hybrid DNNs framework called scale-hybrid-IDS-AlertNet which
can be used in real-time to effectively monitor the network traffic and host-level events to proactively alert
possible cyberattacks.

INDEX TERMS Cyber security, intrusion detection, malware, big data, machine learning, deep learning,
deep neural networks, cyberattacks, cybercrime.

I. INTRODUCTION prone by various attacks from both internal and external

Information and communications technology (ICT) systems intruders [1]. These attacks can be manual and machine
and networks handle various sensitive user data that are generated, diverse and are gradually advancing in obfusca-
tions resulting in undetected data breaches. For instance,
The associate editor coordinating the review of this manuscript and the Yahoo data breach had caused a loss of $350 M and
approving it for publication was Junaid Arshad. Bitcoin breach resulted in a rough estimate of $70M loss [2].
2169-3536
2019 IEEE. Translations and content mining are permitted for academic research only.
VOLUME 7, 2019 Personal use is also permitted, but republication/redistribution requires IEEE permission. 41525
See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

Such cyberattacks are constantly evolving with very sophis-
ticated algorithms with the advancement of hardware, soft-
ware, and network topologies including the recent devel-
opments in the Internet of Things (IoT) [4]. Malicious
cyberattacks pose serious security issues that demand the
need for a novel, flexible and more reliable intrusion detec-
tion system (IDS). An IDS is a proactive intrusion detection
tool used to detect and classify intrusions, attacks, or viola-
tions of the security policies automatically at network-level
and host-level infrastructure in a timely manner. Based
on intrusive behaviors, intrusion detection is classified
into network-based intrusion detection system (NIDS) and
host-based intrusion detection system (HIDS) [5]. An IDS
system which uses network behavior is called as NIDS. The
network behaviors are collected using network equipment via
mirroring by networking devices, such as switches, routers,
and network taps and analyzed in order to identify attacks and
possible threats concealed within in network traffic. An IDS
system which uses system activities in the form of various
log files running on the local host computer in order to detect
attacks is called as HIDS. The log files are collected via
local sensors. While NIDS inspects each packet contents in
network traffic flows, HIDS relies on the information of log
files which includes sensors logs, system logs, software logs,
file systems, disk resources, users account information and
others of each system. Many organizations use a hybrid of
both NIDS and HIDS.
Analysis of network traffic flows is done using misuse
detection, anomaly detection and stateful protocol analysis.
Misuse detection uses predefined signatures and filters to
detect the attacks. It relies on human inputs to constantly
update the signature database. This method is accurate in
finding the known attacks but is completely ineffective in the
case of unknown attacks. Anomaly detection uses heuristic
mechanisms to find the unknown malicious activities. In most
of the scenarios, anomaly detection produces a high false
positive rate [5]. To combat this problem, most organizations
use the combination of both the misuse and anomaly detec-
tion in their commercial solution systems. Stateful protocol
analysis is most powerful in comparison to the aforemen-
tioned detection methods due to the fact that stateful protocol
analysis acts on the network layer, application layer and
transport layer. This uses the predefined vendors specification
settings to detect the deviations of appropriate protocols and
applications. Though deep learning approaches are being
considered more recently to enhance the intelligence of such
intrusion detection techniques, there is a lack of study to
benchmark such machine learning algorithms with publicly
available datasets. The most common issues in the exist-
ing solutions based on machine learning models are: firstly,
the models produce high false positive rate [3], [5] with wider
range of attacks; secondly, the models are not generalizable
as existing studies have mainly used only a single dataset
to report the performance of the machine learning model;
thirdly, the models studied so far have completely unseen
today’s huge network traffic; and finally the solutions are
41526
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
required to persevere today’s rapidly increasing high-speed
network size, speed and dynamics. These challenges form
the prime motivation for this work with a research focus on
evaluating the efficacy of various classical machine learning
classifiers and deep neural networks (DNNs) applied to NIDS
and HIDS. This work assumes the following;
• An attacker aims at pretence as normal user to remain
hidden from the IDS. However, the patterns of intru-
sive behaviors differ in some aspect. This is due to the
specific objective of an attacker for example getting an
unauthorized access to computer and network resources.
• The usage pattern of network resources can be captured,
however the existing methods ends up in high false
positive rate.
• The patterns of intrusions exist in normal traffic with a
very low profile over long time interval.
Overall, this work has made the following contributions to
the cyber security domain:
• By combining both NIDS and HIDS collaboratively,
an effective deep learning approach is proposed by
modeling a deep neural network (DNN) to detect
cyberattacks proactively. In this study, the efficacy
of various classical machine learning algorithms and
DNNs are evaluated on various NIDS and HIDS datasets
in identifying whether network traffic behavior is either
normal or abnormal due to an attack that can be classi-
fied into corresponding attack categories.
• The advanced text representation methods of natural
language processing (NLP) are explored with host-level
events, i.e. system calls with the aim to capture the
contextual and semantic similarity and to preserve the
sequence information of system calls. The comparative
performance of these methods is conducted with the
ADFA-LD and ADFA-WD datasets.
• This study uses various benchmark datasets to conduct a
comparative experimentation. This is mainly due to the
reason that each dataset suffers from various issues such
as data corruptions, traffic variety, inconsistencies, out
of date and contemporary attacks.
• A scalable hybrid intrusion detection framework called
SHIA is introduced to process large amount of
network-level and host-level events to automatically
identify malicious characteristics in order to provide
appropriate alerts to the network admin. The proposed
framework is highly scalable on commodity hardware
server and by joining additional computing resources to
the existing framework, the performance can be further
enhanced to handle big data in real-time systems.
The code and detailed results are made publicly
available [7] for further research. The remainder of the chap-
ter is organized as follows. Section II discusses various
stages of compromise according to attackers perspective.
Section III discusses the related works of similar research
work done to NIDS and HIDS. Information of scalable
framework, the mathematical details of DNNs and text
representation methods for intrusion detection is placed
VOLUME 7, 2019
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
in Section IV. Section V includes information related to
major shortcomings of IDS datasets, problem formulation
and statistical measures. Section VI includes description of
datasets. Section VII and Section VIII includes experimental
analysis and a brief overview of proposed system and archi-
tecture design. Section IX presents the experimental results.
Conclusion, future work directions and discussions are placed
in Section X.
II. STAGES OF COMPROMISE: AN ATTACKER’S VIEW
Mostly, intrusions are initiated by unauthorized users named
as attackers. An attacker can attempt to access a computer
remotely via the Internet or to make a service remotely
unusable. Detection of intrusion accurately requires under-
standing the method to successfully attack a system. Gener-
ally, an attack can be classified into five phases. They are
reconnaissance, exploitation, reinforcement, consolidation,
and pillage. An attack can be detected during the first three
phases however once it reaches the fourth or fifth phase then
the system will be fully compromised. Thus, it is very difficult
to distinguish between a normal behavior and an attack.
During the reconnaissance phase, an attacker tries to collect
information related to reachable hosts and services, as well
as the versions of the operating systems and applications
that are running. During the exploitation phase, an attacker
utilizes a particular service with the aim to access the target
computer. A service may be identified as abusing, subverting,
or breaching. An abusing service includes stolen password or
dictionary attacks and subversion includes an SQL injection.
After an illegal forced entry to a system, an attacker follows
camouflage activity and then installs supplementary tools and
services to take advantage of the privileges gained during
the reinforcement phase. Based on the misused user account,
an attacker tries to gain full system access. Finally, an attacker
utilizes the applications that are accessible from the available
user account. An attacker obtains a complete control over the
system in the consolidation phase and the installed backdoor
which is used for communication purposes during the consol-
idation phase. The final phase is pillage where an attacker’s
possible malicious activities include theft of data and CPU
time, and impersonation.
Since computers and networks are assembled and pro-
grammed by humans, there are possibilities for bugs in both
the hardware and software. These human errors and bugs can
lead to vulnerabilities [8]. Confidentiality, data integrity and
availability are main pillars of information security. Authen-
ticity and accountability are also plays an important role
in information security. Generally attacks against the confi-
dentiality addresses passive attacks for example eavesdrop-
ping, integrity addresses active attacks for example system
scanning attacks i.e. ’Probe’ and availability addresses the
attacks related to making network resources down so these
will be unavailable for normal users for example denial of
service (’DoS’) and distributed denial of service (’DDoS’).
IDS systems have limited capability to detect attacks related
to eavesdropping. ’Probe’ attack can be launched over either
VOLUME 7, 2019
over a network or locally within a system. Now an attack can
be defined as a set of actions that potentially compromises
the confidentiality, data integrity, availability, or any kind of
security policy of a resource. Primarily, an IDS system aims
at detecting all these types of attacks to prevent the com-
puters and networks from malicious activities. In this work,
we focus towards the categorization scheme as suggested by
the DARPA Intrusion Detection Evaluation.
III. RELATED WORKS
The research on security issues relating to NIDS and HIDS
exists since the birth of computer architectures. In recent
days, applying machine learning based solutions to NIDS and
HIDS is of prime interest among security researchers and
specialists. A detailed survey on existing machine learning
based solutions is discussed in detail by [5]. This section
discusses the panorama of largest study to date that explores
the field of machine learning and deep learning approaches
applied to enhance NIDS and HIDS.
A. NETWORK-BASED INTRUSION DETECTION
SYSTEMS (NIDS)
Commercial NIDS primarily use either statistical measures
or computed thresholds on feature sets such as packet length,
inter-arrival time, flow size and other network traffic param-
eters to effectively model them within a specific time-
window [6]. They suffer from high rate of false positive and
false negative alerts. A high rate of false negative alerts
indicates that the NIDS could fail to detect attacks more
frequently, and a high rate of false positive alerts means the
NIDS could unnecessarily alert when no attack is actually
taking place. Hence, these commercial solutions are ineffec-
tive for present day attacks.
Self-learning system is one of the effective methods to
deal with the present day attacks. This uses supervised,
semi-supervised and unsupervised mechanisms of machine
learning to learn the patterns of various normal and malicious
activities with a large corpus of Normal and Attack net-
work and host-level events. Though various machine learning
based solutions are found in the literature, the applicability
to commercial systems is in early stages [9]. The existing
machine learning based solutions outputs high false posi-
tive rate with high computational cost [3]. This is because
machine learning classifiers learn the characteristic of sim-
ple TCP/IP features locally. Deep learning is a complex
subnet of machine learning that learns hierarchical fea-
ture representations and hidden sequential relationships by
passing the TCP/IP information on several hidden layers.
Deep learning has achieved significant results in long stand-
ing Artificial intelligence (AI) tasks in the field of image
processing, speech recognition, natural language process-
ing (NLP) and many others [10]. Additionally, these per-
formances have been transformed to various cyber security
tasks such as intrusion detection, android malware classifica-
tion, traffic analysis, network traffic prediction, ransomware
detection, encrypted text categorization, malicious URL
41527

detection, anomaly detection, and malicious domain name
detection [11]. This work focuses towards analyzing the
effectiveness of various classical machine learning and deep
neural networks (DNNs) for NIDS with the publicly avail-
able network-based intrusion datasets such as KDDCup 99,
NSL-KDD, Kyoto, UNSW-NB15, WSN-DS and CICIDS
2017.
A large study of academic research used the de facto stan-
dard benchmark data, KDDCup 99 to improve the efficacy of
intrusion detection rate. KDDCup 99 was used for the third
International Knowledge Discovery and Data Mining Tools
Competition and the data was created as the processed form
of tcpdump data of the 1998 DARPA intrusion detection (ID)
evaluation network. The aim of the contest was to create
a predictive model to classify the network connections into
two classes: Normal or Attack. Attacks were categorized into
denial of service (’DoS’), ’Probe’, remote-to-local (’R2L’),
user-to-root (’U2R’) categories. The mining audit data for
automated models for ID (MADAMID) was used as feature
construction framework in KDDCup 99 competition [17].
MADAMID outputs 41 features: first 9 features are basic
features of a packet, 10-22 are content features, 23-31 are traf-
fic features, and 32-41 are host-based features. The choices
of available datasets are: (1) full dataset and (2) comple-
mentary 10% data. The detailed evaluation results of KDD-
Cup 98 and KDDCup 99 challenge was published in [3].
Totally, 24 entries were submitted in the KDDCup 98, in that
3 winning entries used variants of decision tree to whom
they showed only the marginal statistics significance in per-
formance. The 9th winning entry in the contest used the
1-nearest neighbor classifier. The first significant difference
in performance was found between 17th and 18th entries.
This inferred that the first 17 submissions method were robust
and were profiled by [3]. The Third International Knowledge
Discovery and Data Mining Tools Competition task remained
as a baseline work and after this contest many machine learn-
ing solutions have been found. Most of the published results
took only the 10% data of training and testing and few of
them used custom-built datasets. Recently, a comprehensive
literature survey on machine learning based ID with KDDCup
99 dataset was conducted [18].
After the challenge, most of the published results of
KDDCup 99 have used several feature engineering meth-
ods for dimensionality reduction [18]. While few studies
employed custom-built datasets, majority used the same
dataset for newly available machine learning classifiers [18].
These published results are partially comparable to the results
of the KDDCup 99 contest.
In [19], the classification model consists of two-stages:
i) P-rules stage to predict the presence of the class, and
ii) N-rules stage to predict the absence of the class. This
performed well in comparison with the aforementioned
KDDCup 99 results except for the user-to-root (’U2R’) cat-
egory. In [20], the significance of feature relevance analysis
was investigated for IDS with the most widely used dataset,
KDDCup 99. For each feature they were able to express
41528
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
the feature relevance in terms of information gain. In addi-
tion, they presented the most relevant features for each class
label. Reference [21] discussed random forest techniques in
misuse detection by learning patterns of intrusions, anomaly
detection with outlier detection mechanism, and hybrid detec-
tion by combining both the misuse and anomaly detection.
They reported that the misuse approach worked better than
winning entries of KDDCup 99 challenge results, and in
addition anomaly detection worked better compared to other
published unsupervised anomaly detection methods. Overall,
it was concluded that the hybrid system enhances the perfor-
mance with the advantage of combining both the misuse and
anomaly detection approaches [22], [23], [72]. In [24], an ID
algorithm using AdaBoost technique was proposed that used
decision stumps as weak classifiers. Their system performed
better than other published results with a lower false alarm
rate, a higher detection rate, and a computationally faster
algorithm. However, the drawback is that it failed to adopt
the incremental learning approach. In [25], the performance
of the shared nearest neighbor (SNN) based model in ID was
studied and reported as the best algorithm with a high detec-
tion rate. With the reduced dataset they were able to conclude
that SNN performed well in comparison to the K-means for
’U2R’ attack category. However, their work failed to show
the results on the entire testing dataset.
In [26], Bayesian networks for ID was explored using
Naive Bayesian networks with a root node to represent a
class of a connection and leaf nodes to represent features
of a connection. Later, [27] investigated the application of
Naive Bayes network to ID and through detailed experi-
mental analysis, they showed that Bayesian networks per-
formed equally well and sometimes even better in ’U2R’ and
’Probe’ categories in comparison with the winning entries
of KDDCup 99 challenge. In [28], a non-parametric den-
sity estimation method based on Parzen-window estimators
was studied with Gaussian kernels and Normal distribution.
Without the intrusion data, their system was comparatively
favorable to the existing winning entries that was based on
ensemble of decision trees. In [29], a genetic algorithm based
NIDS was proposed that facilitates to model both tempo-
ral and spatial information to identify complex anomalous
behavior. An overview of ensemble learning techniques for
ID was given in [30], and swarm intelligence techniques for
ID using ant colony optimization, ant colony clustering and
particle swarm optimization of systems were studied in [31].
A comparative study in such research works show that the
descriptive statistics was predominantly used.
Overall, a comprehensive literature review shows very
few studies use modern deep learning approaches for NIDS
and the commonly used benchmark datasets for experimen-
tal analysis are KDDCup 99 and NSL-KDD [3], [32]–[34].
The IDS based on recurrent neural network (RNN) out-
performed other classical machine learning classifiers in
identifying intrusion and intrusion type on the NSL-KDD
dataset [32]. Two level approach proposed for IDS in which
the first level extracts the optimal features using sparse
VOLUME 7, 2019
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
autoencoder in an unsupervised way and classified using
softmax regression [33]. The application of stacked autoen-
coder was proposed for optimal feature extraction in an
unsupervised way where the proposed method is completely
non-symmetric and classification was done using Random
forest. Novel long short-term memory (LSTM) architecture
was proposed and by modeling the network traffic informa-
tion in time series obtained better performance. The proposed
method performed well compared to all the existing methods
and as well as KDDCup 98 and 99 challenge entries [3]. The
performance of various RNN types were evaluated by [34].
Various deep learning architectures and classical machine
learning algorithms were evaluated for anomaly based ID
on NSL-KDD dataset [74]. The configuration of SVM was
formulated as bi-objective optimization problem and solved
using hyper-heuristic framework. The performance was eval-
uated for malware and anomaly ID. The proposed framework
is very suitable for big data cyber security problems [75].
To enhance the anomaly based ID rate, the spatial and
temporal features were extracted using convolutional neu-
ral network and long short-term memory architecture. The
performance was shown on both KDDCup 99 and ISCX
2012 datasets [76]. Two step attack detection method was
proposed along with a secure communication protocol for
big data systems to identify insider attack. In the first step,
process profiling was done independently at each node and
in second step using hash matching and consensus, process
matching was done [77]. An online detection and estimation
method was proposed for smart grid system [78]. The method
specifically designed for identifying false data injection and
jamming attacks in real-time and additionally provides online
estimates of the unknown and time-varying attack parameters
and recovered state estimates [78]. A scalable framework
for ID over vehicular ad hoc network was proposed. The
framework uses distributed machine learning i.e. alternating
direction method of multipliers (ADMM) to train a machine
learning model in a distributed way to learn whether an
activity normal or attack [79].
B. HOST-BASED INTRUSION DETECTION SYSTEMS (HIDS)
Various software tools such as Metasploit, Sqlmap, Nmap,
Browser Exploitation provide the necessary framework to
examine and gather information from target system vulner-
abilities. Malicious attackers use such information to launch
attacks to various applications like FTP server, web server,
SSH server, etc. Existing methods such as firewall, cryptogra-
phy methods and authentications aim to defend host systems
against such attacks. However, these solutions have limita-
tions and malicious attackers are able to gain unauthorized
access to the system. To address this, a typical HIDS operates
at host-level by analyzing and monitoring all traffic activities
on the system application files, system calls and operating
system [73]. These types of traffic activities are typically
called as audit trials. A system call of an operating system is
a key feature that interacts between the core kernel functions
and low level system applications. Since an application makes
VOLUME 7, 2019
communication with the operating system via system calls,
their behavior, ordering, type and length generates a unique
trace. This can be used to distinguish between the known
and unknown applications [12]. System calls of normal and
intrusive process are entirely different. Thus analysis of those
system calls provides significant information about the pro-
cesses of a system. Various feature engineering approaches
have been used for system call based process classification.
They are N-gram [12], [13], sequence gram [14] and pair
gram [15]. An important advantage of HIDS is that it provides
detailed information about the attacks.
The three main components of HIDS, namely the data
source, the sensor, and the decision engine play an important
role in detecting security intrusions. The sensor component
monitors the changes in data source, and the decision engine
uses the machine learning module to implement to the intru-
sion detection mechanism. However, the benchmarking the
data source component requires much investigation.
Compiling the KDDCup 99 dataset involved the
data source component with system calls and Sequence
Time-Delay Embedding (STIDE) approach used to analyze
the fixed length pattern of system calls to distinguish between
normal and anomalous behaviors [13]. A large number of
decision engines have been used to analyze patterns of
system calls to detect intrusions. Such a data source is
most commonly used among cyber security research com-
munity. Apart from system calls, since Windows operating
system (OS) does not provide a direct access to system calls,
log entries [35] and registry entry manipulations [36] form
the other two most commonly used data sources. This work
focuses on the decision engine component to benchmark the
data source.
Classical methods aim to find information about the nature
of the host activity by analyzing the patterns in the sequence
of system calls. While STIDE was most commonly used
simple algorithm, Support Vector Machines (SVMs), Hid-
den Markov Models (HMMs) and Artificial Neural Net-
works (ANNs) are more recently adopted complex meth-
ods. In [37], N-gram feature extraction approach was used
for compiling the ADFA-LD system call data and N-gram
features were passed to different classical machine learning
classifiers to identify and categorize attacks. In [39], in order
to reduce the dimensions of system calls, K-means and KNN
were experimented using a frequency based model. A revised
version of N-gram model was used in [38] to represent system
calls with various classical machine learning classifiers for
both Binary and Multi-class categories. An approach for
HIDS based on N-gram system call representations with
various classical machine learning classifiers was proposed
in [40]. To reduce the dimensions of N-gram, dimensionality
reduction methods were employed. In [41], frequency dis-
tribution based feature engineering approach with machine
learning algorithms was explored to handle the zero-day and
stealth attacks in Windows OS. In [42], an ensemble approach
for HIDS was proposed using language modeling to reduce
the false alarm rates which is a drawback in classical methods.
41529

This method leveraged the semantic meaning and communi-
cations of system call. The effectiveness of their methods was
evaluated on three different publicly available datasets.
Overall, the published results are limited in detecting the
intrusions and cyberattacks using HIDS. Studies that show an
increase in detection rate of intrusions and cyberattacks also
show an increase in false alarm rate.
The pros and cons of NIDS and HIDS with its efficacy are
discussed in detail by [16]. Major advantages of HIDSs are:
HIDSs facilitate to detect local attacks and are unaffected by
the encryption of network traffic. Major disadvantage is that
they need all the configuration files to identify attack, but it
is a daunting task due to the huge amount of data. Allowing
access to big data technology in the domain of cyber security
is of paramount importance, particularly IDS. The motivation
of this research is to develop a novel scalable platform with
hybrid framework of NIDS and HIDS, which is capable of
handling large amount of data with the aim to detect the
intrusions and cyberattacks more accurately.
IV. PROPOSED SCALABLE FRAMEWORK
Today’s ICT system is considerably more complex, con-
nected and involved in generating extremely large volume
of data, typically called as big data. This is primarily due to
the advancement in technologies and rapid deployments of
large number of applications. Big data is a buzzword which
contains techniques to extract important information from
large volume of data. Allowing access to big data technology
in the domain cyber security particularly IDS is of paramount
importance [44]. The advancement in big data technology
facilitates to extract various patterns of legitimate and mali-
cious activities from large volume of network and system
activities data in a timely manner that in turn facilitates
to improve the performance of IDS. However, processing
of big data by using the conventional technologies is often
difficult [43]. The purpose of this section is to describe the
computing architecture and the advanced methods adopted in
the proposed framework, such as text representation methods,
deep neural networks (DNNs) and the training mechanisms
employed in DNNs.
A. SCALABLE COMPUTING ARCHITECTURE
The technologies such as Hadoop Map reduce and Apache
Spark in the field of high performance computing is found
to be an effective solution to process the big data and to pro-
vide timely actions. We have developed scalable framework
based on big data techniques, Apache Spark cluster com-
puting platform [45]. Due to the confidential nature of the
research, the scalable framework details cannot be disclosed.
The Apache spark cluster computing framework is setup over
Apache Hadoop Yet Another Resource Negotiator (YARN).
This framework facilitates to efficiently distribute, execute
and harvest tasks. Each system has specifications(32 GB
RAM, 2 TB hard disk, Intel(R) Xeon(R) CPU E3-1220 v3
@ 3.10GHz) running over 1 Gbps Ethernet network.
41530
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
The proposed scalable architecture employs distributed
and parallel machine learning algorithms with various opti-
mization techniques that makes it capable of handling very
high volume of network and host-level events. The scalable
architecture also leverages the processing capability of the
general purpose graphical processing unit (GPGPU) cores for
faster and parallel analysis of network and host-level events.
The framework contains two types of analytic engines, they
are real-time and non-real-time. The purpose of analytic
engine is to monitor network and host-level events to generate
an alert for an attack. The developed framework can be scaled
out to analyze even larger volumes of network event data by
adding additional computing resources. The scalability and
real-time detection of malicious activities from early warning
signals makes the developed framework stand out from any
system of similar kind.
B. TEXT REPRESENTATION METHODS
System calls are essential in any operating system depict-
ing the computer processes and they constitute a humon-
gous amount of unstructured and fragmented texts that a
typical HIDS uses to detect intrusions and cyberattacks.
In this research we consider text representation methods
to classify the process behaviors using system call trace.
Classical machine learning approaches adopt feature extrac-
tion, feature engineering and feature representation meth-
ods. However, with advanced machine learning embedded
approach such as deep learning, the necessity of the feature
engineering and feature extraction steps can be completely
avoided. We adopt such advanced deep learning along with
text representation methods to capture the contextual and
sequence related information from system calls. The follow-
ing feature representation methods in the field of NLP are
used to convert the system calls into feature vectors in this
study.
• Bag-of-Words (BoW): This classical and most com-
monly used representation method is used to form
a dictionary by assigning a unique number for each
system call. Term document matrix (TDM) and term
frequency-inverse document frequency (TF-IDF) are
employed to estimate the feature vectors. The drawback
is that it cannot capture the sequence information of
system calls [46].
• N-grams: An N-gram text representation method has
the capability to preserve the sequence information of
system calls. The size of N can be 1 (uni-gram), 2 (bi-
gram), 3 (tri-gram), 4 (four-gram), etc., which can be
employed appropriately depending on the context.
• Keras Embedding: This follows a sequential represen-
tation method to convert the system calls into a numeric
form of vocabulary by simply assigning a unique num-
ber for each system call. The size of vocabulary defines
the number of unique system calls and their frequency
of occurrence places them in an ascending order within a
lookup table. Each system call in a vector is transformed
to a numeric using the lookup table for assigning a
VOLUME 7, 2019
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
corresponding index. We adopt a fixed length vector
method by transforming all vectors to the same length.
C. DEEP NEURAL NETWORK (DNN)
We employ an artificial neural network (ANN) approach
as the computational model since it is influenced by the
characteristics of biological neural networks to incorporate
intelligence in our proposed method. Feed forward neural
network (FFN), a type of ANN is represented as a directed
graph to pass various system information along edges from
one node to another without forming a cycle. We adopt a
multilayer perceptron (MLP) model which is a type of FFN
having three or more layers with one input layer, one or more
hidden layers and an output layer in which each layer has
many neurons or units in mathematical notation. We select
the number of hidden layers by following a hyper parameter
selection method. The information is transformed from one
layer to another layer in a forward direction with neurons in
each layer being fully connected. MLP is defined mathemat-
ically as O : Rm × Rn where m is the size of the input vector
x = x1 , x2 , · · · , xm−1 , xm and n is the size of the output vector
O(x) respectively. The computation of each hidden layer hi is
mathematically defined as
hi (x) = f (wi T x + bi )
where hi : Rdi −1 → Rdi , f : R → R, wi ∈ Rd×di−1 , b ∈ Rdi ,
di denotes the size of the input, f is the non-linear activation
function, which is either a sigmoid (values in the range [0, 1])
or a tangent function (values in the range [1, −1]). For
the classification problem of Multi-class, our MLP model
uses softmax function as the non-linear activation function.
softmax function outputs the probabilities of each class and
selects the largest value among probability values to give a
more accurate value. The mathematical formulae for sigmoid,
tangent and softmax activation function are given below.
1
sigmoid =
1 + e−x
e2x − 1
tan gent = 2x
e +1
e xi
softmax(xi ) = Pn xj
j=1 e
where x defines an input.
Three-layer MLP with a softmax function in output layer
is same as a Multi-class logistic regression model. In general
terms, for many hidden layers, MLP is formulated as follows:
H (x) = Hl (Hl−1 (Hl−2 (· · · (H1 (x)))))
This way of stacking hidden layers is typically called deep
neural networks (DNNs). The architecture of deep neural
network (DNN) as shown in Figure 1 contains 1 hidden
layer. It takes inputs x = x1 , x2 , · · · , xm−1 , xm and outputs
o = o1 , o2 , · · · , oc−1 , oc . However, all the connections and
hidden layers along with its units are not shown in Figure 1.
VOLUME 7, 2019
FIGURE 1. Architecture of a deep neural network (DNN).
We employ DNNs as a more advanced model of the clas-
sical FFN with each hidden layer using the non-linear activa-
tion function, ReLU as it helps to reduce the state of vanishing
and error gradient issue [47]. The advantage of ReLU is that
it is faster than other non-linear activation functions and
facilitates training the MLP model with the large number of
(1) hidden layers. The hidden layers define the depth of the neural
network and the maximum neurons define the width of the
neural network.
The uniqueness of our method is in modeling the loss func-
tions and the ReLU to maximize deep learning efficiently.
These are described in detail.
1) Loss functions: In modeling an MLP, finding an
optimal parameter is essential towards achieving good
performance. This includes the loss function as an ini-
tial step. A loss function is used to calculate the amount
of difference between the predicted and target values.
This is defined mathematically as:
(2) d(t, p) =k t − p k22 (6)
where t denotes the target value and p denotes the
(3)
predicted value.
Multi-class classification uses the negative log prob-
(4)
ability with t as the target class and p(pad) as the
probability distributions as represented below:
d(t, p(pd)) = − log p(pd)t (7)
However, the network receives a list of corrected
input-output set i_o = (i1 , o1 ), (i2 , o2 ), · · · , (in, on) in
(5) the training process. Then, we aim to decrease the mean
of losses as defined below:
n
1X
loss(in, on) = d(oil, f (iris)) (8)
n
i=1
The loss function has to be minimized to get bet-
ter results in a neural network. A loss functions is
41531

defined as;
n nection record includes 100 bytes of information and labeled
1 X
Traini_o (θ ) ≡ Li_o (θ) = d(oi , fθ (ii ))
n attack type. Each connection record has a vector and defined
i=1
where θ = (w1 , b1 , · · · , wn , bn )
Loss function minimization Li_o (θ) is done by follow-
ing a right selection of the value θ ∈ Rd and inherently
includes the estimation of fθ (pi ) and ∇fθ (ii ) at the cost
|i_o|
min L(θ )
θ
Various optimization techniques exist and we adopt
Gradient descent as it is most commonly used. Gradient
descent uses the following rule to calculate and update
parameter repeatedly:
θ new = θold − α∇θ L(θ)
where α denotes learning rate and it is selected based
on a hyper parameter selection approach. To find a
derivative of L, backpropagation or backward propa-
gation of errors algorithm is adopted. Backpropagation
uses chain rule to compute θ ∈ Rd with the aim to
minimize the loss function Li_o (θ). However, most of
the neural network uses an extension of backpropaga-
tion called as stochastic gradient descent (SGD) for
finding minimum θ. SGD uses a mini batch of train-
ing samples im_om, in which training samples i_o are
chosen randomly instead of using the entire training set
im_om ⊆ i_o. SGD update rule is given as:
θ new = θold − α∇θ J (θ; im(i) , om(i) )
where im(i) , om(i) denotes input-output pair training
samples.
2) Rectified Linear Unit (ReLU ): Rectified linear unit
(ReLU ) is found to have a great proficiency and has the
tendency to accelerate the training process [47]. ReLU
was the main breakthrough in the neural network his-
tory for reducing the vanishing and exploding gradient
issue. It’s found as the most efficient method in terms
of time and cost for training huge data in comparison
to the classical non-linear activation function such as
sigmoid and tangent function [47]. We refer to neurons
with this non linearity following [47]. The mathemati-
cal formula for ReLU is defined as follows
f (x) = max(0, x)
where x defines input.
V. PROBLEM FORMULATION, DATASET LIMITATIONS
AND STATISTICAL MEASURES
A. PROBLEM FORMULATION FOR NIDS
Generally, the network traffic data is collected and stored
in raw TCP dump format. Later, this data can be prepro-
cessed and converted into connection records. A connection
is simply a sequence of TCP packets starting and ending at
41532
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
well-defined times with well-defined protocols. Each con-
(9) as either Normal or as an Attack with exactly one particular
as follows
CV = (f1 , f2 , · · · , fn , cl) (14)
where f denotes features of length n, values of each f ∈ R
and cl denotes a class label.
(10) B. PROBLEM FORMULATION FOR HIDS
In general, all the system events which are the system calls
are collected for each process. Each process p is composed of
sequence of system calls S = sp1 , sp2 , · · · spn where sp ∈ S,
sp is a finite set of system calls and S is the set of system
calls used by the host. A sequence of system call information
(11) is used to distinguish the behavior between the Normal and
Attack categories. The sp along with the label such as Normal
or Attack can be used to learn the behaviors of Normal and
Attack activities.
C. DATASET LIMITATIONS
Most of the datasets which represents the current network
traffic attacks are private due to privacy and security issues.
On the other direction, the datasets which are publicly
available are laboriously anonymized and suffer from var-
ious issues. In particular they failed to validate that their
datasets typically exhibit the real-world network traffic pro-
file. KDDCup 99 is one of the most commonly used publicly
available datasets. Although with some known harsh criti-
(12) cisms, it has been continually used as an effective benchmark
dataset for many of the research study towards NIDS over the
years. In contrast to critiques of strategy to create dataset, [50]
revealed the detailed analysis of the contents and located
the non-uniformity and simulated artifacts in the simulated
network traffic data. They strived to scale the performance
of network anomaly detection between the KDDCup 99 and
varied KDDCup 99. They reported that many of the net-
work attributes particularly, remote client address, TTL, TCP
options and TCP window size are indicated as small and
limited range in KDDCup 99 datasets but actually exhibit to
be of large and growing range in real world network traffic
environment.
In [51], discussions indicate why the machine learning
classifiers have limited capability in detecting the attacks that
(13) belong to content (’R2L’ and ’U2R’) category in KDDCup 99
dataset. With this dataset, none of the machine learning clas-
sifiers were able to improve the attack detection rate. They
admitted that the possibility of getting high attack detection
rate in most of the cases is by producing new dataset with a
combination of training and testing datasets. In addition, [52]
found that many ’snmpgetattack’ belongs to ’R2L’ category
attacks. As a result, in most of the cases, machine learning
classifier poorly performs with this data.
DARPA / KDDCup 88 failed to evaluate the classical IDS
and it was one of the major of many criticisms. To mitigate
VOLUME 7, 2019
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
this [53] used Snort ID system on DARPA / KDDCup 98 tcp-
dump traces. The system performed poorly, the accuracy and
the false positive rates were impermissible. This is mainly due
to the system failed to detect the attacks belongs to the ’DoS’
and ’Probe’ category with a fixed signature. In contrast to this,
the detection performance of ’R2L’ and ’U2R’ is much better.
Despite of the harsh criticisms yet, KDDCup 99 is been
the most widely used reliable benchmark dataset in most of
the study related to ID system evaluation and other security
related tasks [55]. To resolve the inherent issues that are exists
in KDDCup 99, [55] proposed a most refined version called
NSL-KDD. They removed the redundant connection records
in the entire train and test data and in addition the invalid
records, numbered 136,489 and 136,497 were removed from
test data. Thus it protects the classifier not to be biased
in the direction of the more frequent connection records.
NSL-KDD is also not a real world representative of network
traffic data. Still, this refined version failed to entirely solve
the issues reported by [57]. To enhance the performances in
detecting attacks, 10 more extra features were added with
14 important features from KDDCup 99 [58]. The Kyoto
dataset was generated using honeypots. Thus, each flow of
network traffic was done automatically. The normal traf-
fic of Kyoto dataset was not captured from the real world
network traffic. Moreover, the dataset doesn’t contain false
positives that help to minimize the number of alerts to the
network admin [58]. In [56] generated a new dataset follow-
ing two different profile system in which one system was
for generating attacks and other one was for normal activi-
ties. This dataset doesn’t contain network traffic of HTTPS
protocol. Most of the attacks were simulated and failed to
preserve the characteristics of real world statistics. In [57]
proposed UNSW-NB15. They adopted the notion of profiles
that contains the comprehensive information of intrusions and
applications, protocols, or lower level network entities from
the modern network traffic and detailed information about
the network traffic. Recently, to provide benchmark dataset
to the research community, [59] generated reliable dataset.
This meets the real world benign and attacks of network
activities. Moreover, the detailed evaluation of network traffic
features was done by them and detailed experiments towards
the importance of features to detect various attacks were
done.
Most widely used dataset for HIDS is KDDCup 98,
KDDCup 99 and University of New Maxico (UNM). These
datasets were compiled decades ago and most of them are
irrelevant for today’s operating system. Recently, [62] made
the dataset to be publicly available. Thus, this dataset has
been used as new benchmark for evaluating system call
based HIDS. The dataset comprises of modern vulnerability
exploits and attacks.
D. STATISTICAL MEASURES
In evaluation to estimate the various statistical measures the
ground truth value is required. The ground truth composed of
set of connection records labeled either Normal or Attack in
VOLUME 7, 2019
the case of Binary classification. Let L and A be the number
of Normal and Attack connection records in the test dataset,
respectively and the following terms are used for determining
the quality of the classification models:
• True Positive (TP) - the number of connection records
correctly classified to the Normal class.
• True Negative (TN ) - the number of connection records
correctly classified to the Attack class.
• False Positive (FP) - the number of Normal connec-
tion records wrongly classified to the Attack connection
record.
• False Negative (FN ) - the number of Attack connection
records wrongly classified to the Normal connection
record.
Based on the aforementioned terms, the following most
commonly used evaluation metrics are considered.
1) Accuracy: It estimates the ratio of the correctly recog-
nized connection records to the entire test dataset. If the
accuracy is higher, the machine learning model is better
(Accuracy ∈ [0, 1]). accuracy serves as a good measure
for the test dataset that contains balanced classes and
defined as follows
TP + TN
Accuracy = (15)
TP + TN + FP + FN
2) Precision: It estimates the ratio of the correctly iden-
tified attack connection records to the number of
all identified attack connection records. If the Preci-
sion is higher, the machine learning model is better
(Precision ∈ [0, 1]). Precision is defined as follows
TP
Precision = (16)
TP + FP
3) F1-Score: F1-Score is also called as F1-Measure. It is
the harmonic mean of Precision and Recall. If the
F1-Score is higher, the machine learning model is better
(F1−Score ∈ [0, 1]). F1-Score is defined as follows

Pr ecision × Recall

F1 − Score = 2 × (17)
Pr ecision + Recall
4) True Positive Rate (TPR): It is also called as Recall.
It estimates the ratio of the correctly classified Attack
connection records to the total number of Attack con-
nection records. If the TPR is higher, the machine
learning model is better (TPR ∈ [0, 1]). TPR is defined
as follows
TP
TPR = (18)
TP + FN
5) False Positive Rate (FPR): It estimates the ratio of
the Normal connection records flagged as Attacks to
the total number of Normal connection records. If the
FPR is lower, the machine learning model is better
(FPR ∈ [0, 1]). FPR is defined as follows
FP
FPR = (19)
FP + TN
41533

TABLE 1. Training and testing connection records from KDDCup 99 and NSL-KDD datasets.
6) Receiver Operating Characteristics (ROC) curve:
ROC is plotted based on the trade-off between the TPR
on the y axis to FPR on the x axis across different
thresholds. Area Under the ROC Curve (AUC) is the
size of the area under the ROC curve used along with
ROC as a comparison metric for the machine learning
models. If the AUC is higher, the machine learning
model is better.
Z 1 TP FP
AUC = d
0 TP + FN TN + FP
VI. MODELLING THE DATASET
Due to security and privacy issues, most of the datasets
are not publicly available. Additionally, the data which are
publicly available are laboriously anonymized and do not
contemplate today’s network traffic variety. Due to these
issues, the exemplary dataset is yet to be discerned [64]. The
details of various IDS datasets are discussed in [59] and [66].
A detailed overview of available datasets between 1998 and
2016 is discussed in detail by [66]. We consider the pros and
cons of existing datasets used in NIDS and HIDS and discuss
how our datasets were modeled.
A. DATASETS USED IN NIDS
1) KDDCup 99: KDDCup 99 dataset was built by pro-
cessing tcpdump data of the 1998 DARPA intrusion
detection challenge dataset. The Mining Audit data
for automated models for ID (MADMAID) frame-
work was used to extract features from raw tcpdump
data. The detailed statistics of the dataset is reported
in Table 1. KDDCup 1998 dataset was created by MIT
Lincon laboratory using 1000’s of UNIX machines and
100’s users accessing those machines. The network
traffic data was captured and stored in tcpdump format
for 10 weeks. The data of first seven weeks was used
as training dataset and rest used as testing dataset.
KDDCup 99 dataset is available in two forms. They
are full dataset and 10% dataset. The dataset contains
41 features and 5 classes (’Normal’, ’DoS’, ’Probe’,
’R2L’, ’U2R’). These features are grouped into differ-
ent categories as given below:
41534
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
•Basic features [1-9]: The packet capture (Pcap)
files of tcpdump are used to extract the basic
features from the packet headers, TCP segments,
and UDP datagram instead of payload. This task
was carried out using a remodeled network analy-
sis framework, Bro IDS.
• Content features [10-22]: Content features are
extracted from the full payload of TCP/IP packets
rooted on domain knowledge in tcpdump files.
The feature analysis of payload has remained
as research area for the last years. Recently,
in [65], a deep learning approach was introduced
to analyze the entire payload data instead of fol-
lowing the feature extraction process. Content
features are mainly used to identify ’R2L’ and
’U2R’ category attacks. For example, many failed
login attempts is the most prominent feature to
indicate the malicious behavior in the entire pay-
load. Unlike other category attacks, ’R2L’ and
’U2R’ category do not have the prominent sequen-
tial patterns due to events happening in a single
connection.
• Time-based traffic features [23-41]: Time-based
traffic features are extracted with a specific tem-
poral window of two seconds. These are grouped
into ’same host’ and ’same service’ based on the
connection characteristics in the past 2 seconds.
To handle slow probing attacks, the aforemen-
tioned characteristics are recalculated based on a
connection window of 100 connections to the same
host. These are typically termed as connection
based or host-based traffic features.
2) NSL-KDD: NSL-KDD is the distilled version of
KDDCup 99 intrusion data. The filters are used to
remove redundant connection records in KDDCup
99 and connection records numbered 136,489 and
136,497 are removed from the test data. NSL-KDD can
protect machine learning algorithms not to be biased.
This can suits well for misuse detection in compared to
the KDDCup 99 dataset. This also suffers from repre-
senting the real-time network traffic profile character-
istics. The detailed statistics of NSL-KDD is reported
in Table 1.
VOLUME 7, 2019
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
TABLE 2. Training and testing connection records of partial dataset of UNSW-NB15.
3) UNSW-NB15: The cyber security research team of
Australian Centre for Cyber Security (ACCS) has intro-
duced a new data called as UNSW-NB15 to resolve
the issues found in the KDDCup 99 and NSL-KDD
datasets. This data is generated in a hybrid way, con-
taining the normal and attack behaviors of a live net-
work traffic using IXIA Perfect Storm tool that has a
repository of new attacks and common vulnerability
exposures (CVE), a storehouse containing information
regarding security vulnerabilities and exposures, which
are known publicly. Two servers were used in IXIA
traffic generator tool where one server generated the
normal activities, whereas the other generated mali-
cious activities in the network. Tcpdump tool used for
capturing network packet traces which took several
hours to compile the whole data of 100 GBs that were
divided into 1,000 MB pcaps using tcpdump. From
pcap files, the features were extracted using Argus and
Bro-IDS in Linux Ubuntu 14.0.4. In addition to the
above methods, depth analysis of each packet was done
with 12 algorithms which are developed using C#. The
data is accessible in two forms as follows:
a) Full connection records consisting of 2 million
connection records
b) A partition of full connection records which is
composed of 82,332 train connection records
and 175,341 test connection records confined
with 10 attacks. The partitioned dataset consists
of 42 features with their parallel class labels
which are Normal and nine different Attacks. The
information regarding simulated attacks category
and its detailed statistics are described in Table 2.
VOLUME 7, 2019
4) Kyoto: The honeypot systems of Kyoto university
network traffic data have 24 statistical features. Among
24 features, 14 features are from KDDCup 99. These
features are important as they are collected from raw
traffic data of Kyoto university honeypot systems.
Additionally, 10 more features are identified with the
honeypot’s network traffic system. In this work, the net-
work logs of the year 2015 are considered. The logs
are preprocessed and divided into training and test-
ing datasets. The detailed statistics of the connection
records are reported in Table 5.
5) WSN-DS: It is an IDS dataset developed for wireless
sensor networks (WSN). This composed of four dif-
ferent types of ’DoS’ attacks: Blackhole, Grayhole,
Flooding, and Scheduling. They used Low-energy
adaptive clustering hierarchy (LEACH) protocol to
collect data from network Simulator 2 (NS-2) and then
preprocessed to generate 23 features. This dataset was
termed as WSN-DS and its detailed statistics is reported
in Table 3.
6) CICIDS2017: This dataset includes the contemporary
activities of benign and attacks which depicts the real-
time network traffic. The main interest is given towards
collecting the real-time background traffic during cre-
ating this dataset. Using B-profile system, benign back-
ground traffic was collected. This benign traffic con-
tains the characteristics of 25 users based on the HTTP,
HTTPS, FTP, SSH, and email protocols. The network
traffic for five days was collected and dumped with
normal activity traffic on one day, and attacks injected
on other days. The various attacks injected were Brute
Force FTP, Brute Force SSH, ’DoS’, Heartbleed, Web
41535
 R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS

TABLE 3. Training and testing WSN-DS dataset.

TABLE 4. Training and testing CICIDS 2017 dataset.

Attack, Infiltration, Botnet and ’DDoS’. They also

claimed that their dataset covers 11 important criteria
which were discussed by [66]. The detailed informa-
tion of CICIDS 2017 dataset is reported in Table 4.
We have randomly chosen 20,000 connection records in
NIDS dataset and passed them into t-SNE [63] and their
visual representations are given in Figure 2 for KDDCup
99 and Figure 3 for CICIDS 2017. Almost both the datasets
are non-linearly separable and the connection records of
CICIDS 2017 is considered as more complex in comparison
with KDDCup 99. Also, CICIDS 2017 dataset is released
recently and contain attacks which have occurred recently.
Moreover, the CICIDS 2017 dataset has the characteristics of
a real-time network traffic.

B. DATASETS USED IN HIDS FIGURE 2. t-SNE visualization of KDDCup 99.

The windows and Linux operating system are the most

well-known and most commonly used operating system (OS).
Most commonly used datasets for host-based intrusion
datasets were compiled decades ago and do not include the
detection are KDDCup 98, KDDCup 991 and UNM.2 These
attacks of modern computer systems. The issues of these
1 http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html datasets were discussed in detail by [62] and proposed a new
2 https://www.cs.unm.edu/ immsec/systemcalls.htm dataset called as ADFA-LD and ADFA-WD.

41536 VOLUME 7, 2019

R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
FIGURE 3. t-SNE visualization of CICIDS 2017.
TABLE 5. Training and testing Kyoto dataset.
TABLE 6. ADFA-LD and ADFA-WD datasets.
1) ADFA Linux (ADFA-LD)/ADFA Windows(ADFA-
WD): ADFA-LD is a sequence of system calls dataset
which was collected in networks of modern operating
systems [62]. These hosts were connected to a Linux
local server. This comprised of several traces of system
calls which were collected under different situations.
This impersonated the real-time situations. These sys-
tem call traces represented system level vulnerabili-
ties and attacks. This server permitted many services
such as remote access, web server, database on an
operating system Ubuntu 11.04 (Linux kernel 2.6.38).
The SSH, FTP and MySQL 14.14 services used their
default ports. Apache 2.2.17 and PHP 5.3.5 and Tiki-
Wiki 8.1 are installed as web based services and web
based collaborative tools respectively. The detailed
statistics of ADFA-LD is reported in Table 6. The attack
types used in ADFA-LD dataset collection is reported
in Table 7. The attack dataset of ADFA-LD is randomly
split into 55% training and 45% testing. The normal
traces of training and validation data are merged and
randomly split for the 55% training and 45% testing.
VOLUME 7, 2019
TABLE 7. Types of attacks in ADFA-LD dataset.
The ADFA-WD comprises of system calls and dynamic
link library (DLL) for various attacks. This was
collected in Windows XP SP2 host using Procmon
program [62]. The system setup enabled default fire-
wall and Norton AV 2013. The system was open for
file sharing and to run different applications like FTP
server, streaming media server, database server, web
server, PDF server etc. Using Metasploit framework
and other custom approaches 12 different known vul-
nerabilities were exploited for installed applications.
The detailed statistics of the ADFA-WD dataset is
reported in Table 6.
VII. EXPERIMENTAL DESIGN
All the experiments were implemented using Python on an
Ubuntu 14.0.4 LTS. All classical machine learning algo-
rithms were implemented using Scikit-learn.3 Deep neural
networks (DNNs) was implemented using GPU enabled Ten-
sorFlow4 as backend with Keras5 higher level framework.
The GPU was NVidia GK110BGL Tesla K40 and CPU had
a configuration (32 GB RAM, 2 TB hard disk, Intel(R)
Xeon(R) CPU E3-1220 v3 @ 3.10GHz) running over 1 Gbps
Ethernet network. To evaluate the performance of DNNs
and various classical machine learning classifiers on various
NIDS and HIDS datasets, the following different test cases
were considered.
1) Classifying the network connection record as either
benign or attack with all features.
2) Classifying the network connection record as either
benign or attack and categorizing an attack into its
categories with all features.
3) Classifying the network connection record as either
benign or attack and categorizing an attack into its
categories with minimal features.
A. FINDING OPTIMAL PARAMETERS IN DNNs
As DNNs are parametrized, the performance depends on the
optimal parameters. The optimal parameter determination for
DNNs network parameter and DNNs network topologies was
done only for KDDCup 99 dataset. To identify the ideal
3 https://scikit-learn.org/stable/
4 https://www.tensorflow.org/
5 https://keras.io/
41537

parameter for the DNNs, a medium sized architecture was
used for experiments with a specific hidden units, learning
rate and activation function. A medium sized DNN contains
3 layers. One is input layer, second one is hidden layer or fully
connected layer and third one is output layer. For KDDCup
99, the input layer contains 41 neurons, hidden layer contains
128, 256, 384, 512, 640, 768, 896 and 1,024 units and output
layer contains 1 neuron in classifying the connection record
as either normal or attack. It contains 5 neurons in classi-
fying the connection record as either normal or attack and
categorizing attack into corresponding attack categories. The
connection between the units between input layer and hidden
layer and hidden layer to output layer are fully connected.
Initially, the train and test datasets were normalized using L2
normalization. Two trials of experiments were run for hidden
units 128, 256, 384, 512, 640, 768, 896 and 1,024 with a
medium sized DNN. The experiment was run for each param-
eter with appropriate units and for 300 epochs. The DNN
with various units have learnt the patterns of normal con-
nection records with epochs 200 in comparison to the those
with attacks. To capture the significant features which can
distinguish the attack connection record by DNN, 200 epochs
were required. After 200 epochs, the performance of nor-
mal connection records fluctuated due to overfitting. Each
number of units with DNN took varied number of epochs to
attain considerable performance. It was found that the layer
containing 1,024 units had shown highest number of attack
detection rates. When we increased the number of hidden
units from 1,024 to 2,048, the performance in attack detection
rate deteriorated. Hence, we decided to use 1,024 units for
the rest of the experiments. The medium sized DNN with
1,024 units in hidden layer was used for experiments with
Multi-class classification of KDDCup 99 using three trials
of experiments for each hidden units until 500 epochs as
the DNN performed well in comparison to the other units.
A medium sized DNN with less number of units, 128, 256 and
384 learned the patterns of high frequency attack, ’DoS’. The
performance in detection of ’DoS’ attack remained same for
other variants in the number of units of a medium sized DNN.
Due to the large number of connection records of ’DoS’,
DNN network with less number of units was able to achieve
optimal detection rate. The acceptable detection rate for
’Probe’ category of attacks was found with units 512 and 640.
A medium sized DNN with hidden units of 896 performed
well for detection of ’R2L’ attacks in comparison to the other
units. A medium sized DNN required 1,024 units to detect
the attacks of ’U2R’. Once the number of units increased
from 1,024, the performance of DNN network deteriorated.
By considering all these test experiments, 1,024 was set as
the ideal hidden layer units. To achieve a considerable perfor-
mance, each DNN network topology required varied number
of epochs. DNN network with less number of parameters
have achieved good performance till 100 epochs but when it
reaches 500 epochs, complex DNN networks have performed
well in comparison to the DNN network with less number of
parameters.
41538
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
In order to find an optimal learning rate, three trials of
experiments for 500 epochs with learning rate varying in
the range [0.01-0.5] were run. These experiments used a
medium sized DNN with 1,024 units. Learning rate has a
strong impact on the training speed, thus we had selected
the range [0.01-0.5]. The peak value for attack detection rate
was obtained when the learning rate was 0.1. There was
a quick decrease in attack detection rate when the learn-
ing rate was 0.2 and reached to peak accuracy at learn-
ing rates of 0.35, 0.45 and 0.45 compared to learning rate
0.1. This attack detection rate was intensified by running
the experiments till 1,000 epochs. As we had examined
more complex architectures for this experiment, it showed
less performance for epochs less than 500, henceforth we
decided to use the learning rate 0.1 for the rest of the
experimentation process, because learning rate greater than
0.1 was found to be time consuming. To find the opti-
mal learning rate for Multi-class classification of KDDCup
99, we run two trials of experiments for learning rate in
the range [0.01-0.5]. The experiments with lower learning
rate 0.01 showed better performance for attacks ’DoS’ and
’Probe’. When we increase the learning rate from 0.01,
the attack detection rate remained same. Experiments with
learning rate 0.1 has showed optimal performance in detec-
tion of ’R2L’ and ’U2R’ attacks category. Based on the
observations of performance of detection of attacks in both
Binary and Multi-class classification, the learning rate was set
to 0.1
In third trial of experiments, we had also run experi-
ments with the sigmoid and tanh activation functions for
both the Binary and Multi-class classification. These func-
tions achieved good attack detection rates than the ReLU for
100 epochs in Binary classification. When the same set of
experiments were run for 500 epochs the experiments with
ReLU activation function performed better than the sigmoid
and tanh activation functions. In the case of Multi-class
classification, the performance of ReLU was good in com-
parison to the sigmoid and tanh activation functions. Thus,
we decided to set the ReLU activation function for the rest
of the experiments. All the models were trained using adam
optimizer with a batch size of 64 for 500 epochs to monitor
validation accuracy.
B. FINDING AN OPTIMAL NETWORK TOPOLOGY OF DNN
The following network topologies were used to choose
the best network topology for training an IDS model with
KDDCup 99.
1) DNN 1 layer
2) DNN 2 layers
3) DNN 3 layers
4) DNN 4 layers
5) DNN 5 layers
For all the above network topologies, we had run 3 trials
of experimentation for 300 epochs each. We observed that
most of the deep learning architectures learnt the Normal
VOLUME 7, 2019
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
TABLE 8. Configuration of proposed DNN model.
category patterns of input data for epochs less than 400,
while the number of epochs required for discovering Attack
category was fluctuating. Both the DNN 1 layer and DNN
2 layers networks have completely failed to learn the attack
categories of ’R2L’ and ’U2R’. The performance of ’DoS’
and ’Probe’ attack categories was good with DNN 3 layers in
comparison to the DNN 2 layers and DNN 1 layer. The com-
plex network architectures required a large number of epochs
in order to reach the optimum accuracy. The performance
of DNN 5 layers for various Attack categories and Normal
category was good as compared to other DNNs network
topologies. By considering all these factors, we’ve decided to
use 5 layer DNNs network for the remaining experimentation
process.
In order to increase the speed of training and to avert
over fitting, we used batch normalization and dropout
(0.01) approach. When we run experiments without dropout,
the models ends up in over fitting. Also, the experiments with
batch normalization achieved better results in comparison to
the networks without batch normalization [10]. For HIDS,
the best performed DNNs in NIDS as such used. In HIDS,
we had followed hyper parameter tuning methods only in
conversion of system calls into numeric representation. For
N-gram, the 3 trials of experiments were run with 1-gram,
2-gram, 3-gram and 4-gram with different DNNs network
topologies. DNNs network topologies with 3-gram system
call representation performed well in comparison to the other
N-gram system call representation.
VOLUME 7, 2019
C. PROPOSED DNN ARCHITECTURE
This work proposes a unique DNN architecture for NIDS
and HIDS composed of an input layer, 5 hidden layers and
an output layer. The hierarchical layers in the DNN facili-
tate to extract highly complex features and do better pattern
recognition capabilities in IDS data. Each layer estimates
non-linear features that are passed to the next layer and the
last layer in the DNN performs the classification. An input
layer contains 41 neurons for KDDCup 99, 41 neurons for
NSL-KDD, 43 neurons for UNSW-NB15, 17 neurons for
WSN-DS and 77 neurons for CICIDS 2017. An output layer
contains 1 neuron for Binary classification for all types of
datasets and 5 neurons for Multi-class classification in KDD-
Cup 99, 5 neurons for NSL-KDD, 10 neurons for UNSW-
NB15, 5 neurons for WSN-DS and 8 neurons for CICIDS
2017. The detailed information and configuration details of
the DNN architecture is shown in Table 8. The DNN is
trained using the backpropogation mechanism [60]. Gener-
ally, the units in input to hidden layer and hidden to output
layer are fully connected. The DNN is composed of various
components, a brief description of each component is given
below.
Fully connected layer: This layer is called as fully con-
nected layer since the units in this layer have connection to
every other unit in the succeeding layer. Generally, the fully
connected layers map the data into high dimensions. The
output will be more accurate, when the dimension of data is
more. It uses ReLU as the non-linear activation function.
41539

Batch Normalization and Regularization: Dropout
(0.01) and Batch Normalization [10] was used in between
fully connected layers to obviate overfitting and speedup
the DNN model training. A dropout removes neurons with
their connections randomly. In our alternative architectures,
the DNNs could easily overfit the training data without regu-
larization even when trained on large number samples.
Classification: The last layer is a fully connected layer
which uses sigmoid activation function for Binary classifi-
cation and softmax activation function for Multi-class classi-
fication. The prediction loss function for sigmoid is defined
using Binary cross entropy and the prediction loss for softmax
is defined using the Categorical cross entropy as follows:
The prediction loss for Binary classification is estimated
using Binary cross entropy given by,
N
1 X
loss(pd, ed) = − [edi log pdi +(1−edi ) log(1−pdi )]
N
i=1
(20)
where pd is a vector of predicted probability for all samples
in testing dataset, ed is a vector of expected class label, values
are either 0 or 1.
The prediction loss for Multi-class classification is esti-
mated using Categorical cross entropy given by,
X followed by the text representation method to map the
loss(pd, ed) = − pd(x) log(ed(x)) (21)
x
where ed is true probability distribution, pd is predicted
probability distribution. We have used adam as an optimizer
to minimize the loss of Binary cross entropy and Categorical
cross entropy.
VIII. SCALE-HYBRID-IDS-ALERTNET (SHIA) FRAMEWORK
An IDS has become an indispensable tool for any type of
organization or industry due to the wide growing nature of
data and internet. There are many attempts that have been
made to develop solutions for IDS. These methods used single
host for storage and computational resources and the algo-
rithms are not distributed. Using these legacy solutions, it is
entirely difficult to monitor and identify intrusions in today’s
network. This is due to high speed networks and attacks are
more and occurring rapidly. The legacy intrusion detection
methods which are existing in internet struggle to keep a
watch on the networks more efficiently. To address this, based
on [61] our work leverages the distributed computing and dis-
tributed machine learning models to propose Scale-Hybrid-
IDS-AlertNet (SHIA) framework for an effective identifica-
tion of intrusions and attacks at both the network-level and
host-level. The framework provides a scalable design and acts
as a distributed monitoring and reporting system. The SHIA
enhances the computational performance using the charac-
teristics of distributed computing and distributed machine
learning algorithms using a hybrid system placed in different
locations in the network. The deployed system is designed
to use the computational resource optimally and at the same
time with low latency in response while monitoring a critical
41540
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
system. The SHIA framework is basically decomposed into
two modules described below:
1) Packet and system call processing module: In this
module, the networks which are to be monitored are
connected to a single port mirroring switch, which
replicates the flow of the entire network traffic of all
the switches. The proposed SHIA IDS is required to
monitor a network composed of different subnets, each
with n number of different machines. The monitored
networks are hosts composed of computer machines
which allow users to communicate and transfer data.
All the traffic generated by the internet were collected,
without considering the internal traffic between net-
works.
The SHIA framework with the network where one of
the switches is used as a port mirroring switch and
connected to a traffic collector. This module collects
network traffic data using Netmap packet capturing
tool and stores it in NoSQL database. Feature vectors
are passed into the DNN module, and a copy of data
is passed into NoSQL database. Likewise, the system
calls and configuration files are collected in a dis-
tributed manner by following the methodology pro-
vided in [62]. These are passed to NoSQL database and
system calls to feature vectors. A copy of these feature
vectors are dumped into NoSQL database and these
feature vectors are again passed into the DNN module
for classification.
2) DNN module: From the experimental analysis,
we found that the DNN performed well over other
algorithms in all cases of HIDS and NIDS. Thus, DNN
is used to model the network activities with the aim
to detect the attacks more accurately. DNNs require
large volume of network and host-level events to learn
the behaviors of legitimate and malicious activities.
To make the classifier more generalizable, the network
traffic activities can be collected in different time with
different users in an isolated network. Finally, the DNN
module outputs are passed to Front End Broker. This
displays the results to the network admin. The imple-
mentation details regarding how to conduct a compre-
hensive experimental analysis will be considered as one
of the significant work directions towards future work.
IX. RESULTS
Publicly available NIDS and HIDS datasets were used to
evaluate the performance of classical machine learning and
DNNs in order to identify a baseline method. These datasets
were separated into train and test datasets, and normalized
using L2 normalization. Train datasets were used to train
machine learning model and test datasets were used to eval-
uate the trained machine learning models. Train accuracy
of Multi-class using DNN for KDDCup 99, NSL-KDD and
UNSW NB-15, WSN-DS are shown in Figure 4a and 4b
VOLUME 7, 2019
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS

FIGURE 4. Train accuracy. (a) KDDCup 99 and NSL-KDD. (b) UNSW-NB-15 and WSN-DS. (c) Visualization of 100 connection records with their
corresponding activation values of the last hidden layer neurons from Kyoto.

FIGURE 5. ROC curves of (a) KDDCup 99-using classical machine learning classifiers, (b) KDDCup 99-using DNNs, (c) NSL-KDD-using classical
machine learning classifiers, (d) NSL-KDD-using DNNs.

FIGURE 6. ROC curves of (a) UNSW-NB 15-using classical machine learning classifiers, (b) UNSW-NB 15-using DNNs, (c) Kyoto-using classical
machine learning classifiers, (d) Kyoto-using DNNs.

respectively. For KDDCup 99 and NSLKDD datasets, most
of the DNN network topologies showed train accuracy in
the range 95% to 99%. For UNSW-NB15 and WSN-DS,
all the DNN network topologies showed train accuracy in
the range 65% to 75%. Several observations were extracted
including ROC curve. The ROC curve for KDDCup 99,
NSL-KDD, UNSW NB-15, Kyoto, WSN-DS is shown in
Figure 5a, Figure 5b, Figure 5c, Figure 5d, Figure 6a,
Figure 6b, Figure 6c, Figure 6d, Figure 7a, Figure 7b and
Figure 7c, Figure 7d respectively. In most of the cases,
DNN performed well in comparison to the classical machine
learning classifiers with AUC used as the standard metric.
This indicates that the DNN obtained a highest TPR and a
lowest FPR and in some cases close to 0. The performance
obtained in terms of FPR is less in comparison to other
classical machine learning classifiers in all the datasets. The
experiments with 3-gram representation performed well as
compared to 1-gram and 2-gram.
A. PERFORMANCE COMPARISONS
The detailed results for Binary as well as Multi-class clas-
sification of various classical machine learning classifiers
and DNNs are reported in Table 9, Table 10 and Table 11,
Table 12 respectively. In terms of accuracy noted that the DT,
AB and RF classifiers performed better than the other classi-
fiers namely LR, NB, KNN and SVM-rbf. Additionally, the
performance of DT, AB and RF classifiers remains the same
range across different datasets. However, the performance

VOLUME 7, 2019 41541


FIGURE 7. ROC curves of (a) WSN-DS-using classical machine learning classifiers, (b) WSN-DS-using DNNs, (c) CICIDS 2017-using classical
machine learning classifiers, (d) CICIDS 2017-using DNNs.
TABLE 9. Test results of DNNs for Binary class classification.
of LR, NB, KNN and SVM-rbf are varied across different
datasets. This indicates that the DT, AB and RF classifiers
are generalizable and can detect new attacks. While in the
41542
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
TABLE 10. Test results of DNNs for Multi-class classification.
case of multi-class classification the performance of AB is
less in compared to DT and RF but performed better than
the LR, NB, KNN and SVM-rbf. This is due to the fact that
both AB and SVM are not directly applicable for multi-class
classification problems. In multi-class, we deal with strength-
ening the classifier in identifying each individual attacks.
Experiments on KDDCup 99 and NSL-KDD, all the classical
machine learning classifiers obtained less TPR for both ’R2L’
VOLUME 7, 2019
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
TABLE 11. Test results of various classical machine learning classifiers for
binary class classification.
and ’U2R’ in compared to the other categories such as ’DoS’
and ’Probe’. The primary reason is that both the categories of
attacks contain very less number of samples in training sets.
VOLUME 7, 2019
TABLE 12. Test results of various classical machine learning classifiers for
Multi-class classification.
Thus during training, the classifiers gives less preference for
these attack categories. In terms of accuracy, the performance
of the DNN is clearly superior to that of classical machine
learning algorithms, often by a large margin in both Binary
and Multi-class classification. Moreover, with DNN network
topologies, the performance in terms of accuracy is closer
to each other’s. For Multi-class classification, accuracy, true
positive rate (TPR) and false positive rate (FPR) are estimated
for each class. The detailed results are shown in Table 15 for
KDDCup 99, Table 16 for NSL-KDD, Table 17 for WSN-DS,
41543

FIGURE 8. Sailency map for a randomly chosen connection record from (a) KDDCup 99, (b) CICIDS 2017 and visualization of 100 connection
records with their corresponding activation values of the last hidden layer neurons from (c) KDDCup 99, and (d) NSLKDD.
TABLE 13. Test results using minimal feature sets.
Table 18 for UNSW-NB15 and Table 19 for CICIDS 2017.
The proposed method, DNN with 3 layer showed an accuracy
of 93.5% that varies -0.32 from the top performed method [3].
However, the proposed method contains less number of
parameters. Thus, the proposed method is computationally
inexpensive. Moreover, the top performed method [3] uses
LSTM, primarily LSTM has been used on raw data [10].
There may be chance that the performance of LSTM can
degrade when it sees the real-time datasets or completely
unseen samples. The performance obtained in terms of FPR
is less comparatively to other classical machine learning clas-
sifiers in all the datasets.
False positive occurs when the IDS identifies a connection
record as an attack when it is actually a normal traffic. False
negative occurs when the IDS fails to interpret a malicious
connection record as an attack. In these cases, IDS must
be carefully tuned to ensure that these are kept very low.
The reported results can be further enhanced by carefully
following a hyper parameter selection method with highly
complex DNN architecture. In experiments with HIDS, Keras
embedding performed better than the N-gram and tf-idf text
representation on both HIDS datasets, as shown in Table 14.
Generally, in DNNs, the network connection records are
propagated through more than one hidden layers to learn the
optimal features. Each hidden layer aims at mapping the data
41544
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
TABLE 14. Test results of host-based IDS.
into the higher dimension. Each layer facilitates to under-
stand the significant features towards classifying the network
connection into either Normal or Attack and in categorizing
the attack into their attack categories. To understand, visual-
ize and analyze the results, the activation values are passed
into t-SNE [63]. This converts the high dimensional activa-
tion values into low dimensional using Principal Component
Analysis (PCA). The low dimensional feature representation
for KDDCup 99, NSLKDD and Kyoto is represented in
Figure 8c, Figure 8d and Figure 4c respectively. The connec-
tion records of ’Normal’, ’DoS’ and ’Probe’ have appeared
completely in a different cluster in KDDCup 99. This shows
that DNN has learnt the patterns which can distinguish the
connection records of ’Normal’, ’DoS’ and ’Probe’. It has
not completely learnt the optimal features to distinguish the
connection records of ’U2R’ and ’R2L’. This is one of the
reasons why few connection records of ’U2R’ and ’R2L’ have
appeared in ’Probe’ attack cluster. This shows that the attacks
of ’Probe’, ’U2R’ and ’R2L’ have common characteristics.
For NSL-KDD, the DNN had same issue as KDDCup 99.
For Kyoto dataset, few attacks have appeared in clusters of
VOLUME 7, 2019
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
TABLE 15. Detailed test results for Multi-class classification- KDDCup 99.
TABLE 16. Detailed test results for Multi-class classification- NSL-KDD.
TABLE 17. Detailed test results for Multi-class classification- WSN-DS.
normal connection records. This shows that they have similar
characteristics and it requires additional features to classify it
correctly.
To know the importance of each feature and as well as
to identify the significant features, the methodology of [69]
VOLUME 7, 2019
has been followed. This uses Taylor expansion for the fea-
tures of penultimate layer and finds the first order partial
derivative of the classification results before placing them
through the softmax function. This helps to detect the signif-
icant features to distinguish the connection record as either
41545

TABLE 18. Detailed test results for Multi-class classification- UNSW-NB15.
Normal or Attack and categorize an Attack into its categories.
The connection record which belongs to ’R2L’ is shown
in Figure 8a. The features have similar characteristics as of
features of ’U2R’. For CICIDS 2017, the connection record
which belongs to ’DoS’ is shown in Figure 8b. The features
have similar characteristics between the ’DoS’ and ’DDoS’.
This shows that the dataset requires few more additional fea-
tures to classify the connection record to ’DoS’ and ’DDoS’
correctly.
Both classical machine learning classifiers and DNNs net-
works have performed well on KDDCup 99 in comparison
to the NSL-KDD. The NSL-KDD is a refined version of
41546
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
KDDCup 99 dataset. Thus, the dataset has unique set of
train and test connection records. Moreover, the connection
records of NSL-KDD is highly non-linearly separable in
comparison to the KDDCup 99. Moreover, the performance
of both the classical machine learning classifiers and DNNs
considerably less in comparison to the KDDCup 99 and
NSL-KDD. On subset of CICIDS 2017, both the classi-
cal machine learning classifiers and DNNs performed well.
Thus, the proposed SHIA architecture in this work can work
well in real-time. The performance of DNNs can be enhanced
by carefully following a hyper parameter techniques for
NSL-KDD and UNSW-NB 15.
VOLUME 7, 2019
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
TABLE 19. Detailed test results for Multi-class classification- CICIDS 2017.
The detailed test results of ADFA-LD and ADFA-WD
datasets are reported in Table 14. N-gram and Keras embed-
ding text representation methods are used to transform sys-
tem call into numeric vectors with DNNs. For comparative
study, tf-idf is used as system call representation method with
classical machine learning classifier, SVM. The performance
of N-gram and Keras embedding is good in compared to
tf-idf. This is due to the fact that both N-gram and Keras
embedding have the capability to preserve the sequence infor-
mation of the system calls. Moreover, the Keras embedding
performed well over N-gram representation method. This
is due to the fact that it facilitates to capture the relation
among system calls. To choose the best value for N in
N-gram, the experiments are run with 1, 2 and 3 gram.
When the N is increased from 3 to 4, the performance
reduced. The experiments with 3-gram representation per-
formed well in compared to 1-gram and 2-gram. However,
the N-gram and tf-idf representation produces very large
matrix and in some cases this type of matrix can be sparse.
Thus there may be chance that using any classifier it is very
difficult to achieve best performance on the sparse repre-
sentation. An additional advantage of Keras embedding is
that the weights of the embedding layer is updated during
backpropogation.
VOLUME 7, 2019
B. IMPORTANCE OF MINIMAL FEATURE SETS
Feature selection is an important step for intrusion detection.
It is an important step in order to identify the various types of
attacks more accurately. Without feature selection, there may
be a possibility in misclassification of attacks and it would
take a large time to train a model [70]. The significance of
feature selection method was discussed in detail for intru-
sion detection using NLS-KDD dataset [71]. They reported
that the feature selection method significantly reduces the
training and testing time and also showed improved intru-
sion detection rate. To evaluate the performance of vari-
ous DNN topologies and static machine learning classifiers,
two trials of experiments are run on minimal feature sets
on KDDCup 99 and NSL-KDD [3]. The detailed results are
reported in Table 13. The experiments with 11 and 8 fea-
ture sets performed well in comparison to the experiments
with 4 feature set. Moreover, experiments with 11 feature
sets performed well in comparison to the 8 feature set. The
difference in performance between 11 and 8 minimal feature
sets is marginal.
X. CONCLUSIONS AND FUTURE WORK
In this paper, we proposed a hybrid intrusion detection alert
system using a highly scalable framework on commodity
41547

hardware server which has the capability to analyze the
network and host-level activities. The framework employed
distributed deep learning model with DNNs for handling and
analyzing very large scale data in real-time. The DNN model
was chosen by comprehensively evaluating their performance
in comparison to classical machine learning classifiers on
various benchmark IDS datasets. In addition, we collected
host-based and network-based features in real-time and
employed the proposed DNN model for detecting attacks and
intrusions. In all the cases, we observed that DNNs exceeded
in performance when compared to the classical machine
learning classifiers. Our proposed architecture is able to per-
form better than previously implemented classical machine
learning classifiers in both HIDS and NIDS. To the best of
our knowledge this is the only framework which has the
capability to collect network-level and host-level activities
in a distributed manner using DNNs to detect attack more
accurately.
The performance of the proposed framework can be fur-
ther enhanced by adding a module for monitoring the DNS
and BGP events in the networks. The execution time of the
proposed system can be enhanced by adding more nodes to
the existing cluster. In addition, the proposed system does
not give detailed information on the structure and charac-
teristics of the malware. Overall, the performance can be
further improved by training complex DNNs architectures
on advanced hardware through distributed approach. Due to
extensive computational cost associated with complex DNNs
architectures, they were not trained in this research using the
benchmark IDS datasets. This will be an important task in
an adversarial environment and is considered as one of the
significant directions for future work.
ACKNOWLEDGMENT
The authors would like to thank NVIDIA India, for the GPU
hardware support to research grant. They would also like
to thank Computational Engineering and Networking (CEN)
department for encouraging the research.
REFERENCES
[1] B. Mukherjee, L. T. Heberlein, and K. N. Levitt, ‘‘Network intrusion
detection,’’ IEEE Netw., vol. 8, no. 3, pp. 26–41, May 1994.
[2] D. Larson, ‘‘Distributed denial of service attacks–holding back the flood,’’
Netw. Secur., vol. 2016, no. 3, pp. 5–7, 2016.
[3] R. C. Staudemeyer, ‘‘Applying long short-term memory recurrent neural
networks to intrusion detection,’’ South Afr. Comput. J., vol. 56, no. 1,
pp. 136–154, 2015.
[4] S. Venkatraman and M. Alazab, ‘‘Use of data visualisation for
zero-day Malware detection,’’ Secur. Commun. Netw., vol. 2018,
Dec. 2018, Art. no. 1728303. [Online]. Available: https://doi.org/10.1155/
2018/1728303
[5] P. Mishra, V. Varadharajan, U. Tupakula, and E. S. Pilli, ‘‘A detailed
investigation and analysis of using machine learning techniques for intru-
sion detection,’’ IEEE Commun. Surveys Tuts., to be published. doi:
10.1109/comst.2018.2847722.
[6] A. Azab, M. Alazab, and M. Aiash, ‘‘Machine learning based botnet
identification traffic,’’ in Proc. 15th IEEE Int. Conf. Trust, Secur. Privacy
Comput. Commun. (Trustcom), Tianjin, China, Aug. 2016, pp. 1788–1794.
[7] R. Vinayakumar. (Jan. 2, 2019). Vinayakumarr/Intrusion-Detection V1
(Version V1). [Online]. Available: http://doi.org/10.5281/zenodo.2544036
41548
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
[8] M. Tang, M. Alazab, Y. Luo, and M. Donlon, ‘‘Disclosure of cyber secu-
rity vulnerabilities: time series modelling,’’ Int. J. Electron. Secur. Digit.
Forensics, vol. 10, no. 3, pp. 255–275, 2018.
[9] V. Paxson, ‘‘Bro: A system for detecting network intruders in real-
time,’’ Comput. Netw., vol. 31, nos. 23–24, pp. 2435–2463, 1999.
doi: 10.1016/S1389-1286(99)00112-7.
[10] Y. LeCun, Y. Bengio, and G. Hinton, ‘‘Deep learning,’’ Nature, vol. 521,
no. 7553, p. 436, 2015.
[11] Y. Xin et al., ‘‘Machine learning and deep learning methods for cyberse-
curity,’’ IEEE Access, vol. 6, pp. 35365–35381, 2018.
[12] S. A. Hofmeyr, S. Forrest, and A. Somayaji, ‘‘Intrusion detection using
sequences of system calls,’’ J. Comput. Secur., vol. 6, no. 3, pp. 151–180,
1998.
[13] S. Forrest, S. A. Hofmeyr, A. Somayaji, and T. A. Longstaff, ‘‘A sense of
self for unix processes,’’ in Proc. IEEE Symp. Secur. Privacy, May 1996,
pp. 120–128.
[14] N. Hubballi, S. Biswas, and S. Nandi, ‘‘Sequencegram: n-gram modeling
of system calls for program based anomaly detection,’’ in Proc. 3rd Int.
Conf. Commun. Syst. Netw. (COMSNETS), Jan. 2011, pp. 1–10.
[15] N. Hubballi, ‘‘Pairgram: Modeling frequency information of lookahead
pairs for system call based anomaly detection,’’ in Proc. 4th Int. Conf.
Commun. Syst. Netw. (COMSNETS), Jan. 2012, pp. 1–10.
[16] H. Kozushko, ‘‘Intrusion detection: Host-based and network-based intru-
sion detection systems,’’ Independ. Study, New Mexico Inst. Mining Tech-
nol., Socorro, NM, USA, 2003.
[17] W. Lee and S. J. Stolfo, ‘‘A framework for constructing features and models
for intrusion detection systems,’’ ACM Trans. Inf. Syst. Secur., vol. 3, no. 4,
2000, Art. no. 227261. doi: 10.1145/382912.382914.
[18] A. Ozgur and H. Erdem, ‘‘A review of KDD99 dataset usage in intrusion
detection and machine learning between 2010 and 2015,’’ PeerJ PrePrints,
vol. 4, Apr. 2016, Art. no. e1954.
[19] R. Agarwal and M. V. Joshi, ‘‘PNrule: A new framework for learning
classifier models in data mining,’’ Dept. Comput. Sci., Univ. Minnesota,
Minneapolis, MN, USA, Tech. Rep. TR 00-015, 2000.
[20] H. G. Kayacik, A. N. Zincir-Heywood, and M. I. Heywood, ‘‘Selecting
features for intrusion detection: A feature relevance analysis on KDD 99
intrusion detection datasets,’’ Proc. 3rd Annu. Conf. Privacy, Secur. Trust,
2005, pp. 12–14.
[21] J. Zhang, M. Zulkernine, and A. Haque, ‘‘Random-forests-based network
intrusion detection systems,’’ IEEE Trans. Syst., Man, Cybern. C, Appl.
Rev., vol. 38, no. 5, pp. 649–659, Sep. 2008.
[22] S. Huda, J. Abawajy, M. Alazab, M. Abdollalihian, R. Islam, and
J. Yearwood, ‘‘Hybrids of support vector machine wrapper and filter based
framework for malware detection,’’ Future Gener. Comput. Syst., vol. 55,
pp. 376–390, Feb. 2016.
[23] M. Alazab et al., ‘‘A hybrid wrapper-filter approach for Malware detec-
tion,’’ J. Netw., vol. 9, no. 11, pp. 2878–2891, 2014.
[24] W. Hu, W. Hu, and S. Maybank, ‘‘AdaBoost-based algorithm for network
intrusion detection,’’ IEEE Trans. Syst., Man, Cybern. B, Cybern., vol. 38,
no. 2, pp. 577–583, Apr. 2008.
[25] L. Ertöz, M. Steinbach, and V. Kumar, ‘‘Finding clusters of different sizes,
shapes, and densities in noisy, high dimensional data,’’ in Proc. SIAM Int.
Conf. Data Mining, 2013, pp. 47–58.
[26] N. B. Amor, S. Benferhat, and Z. Elouedi, ‘‘Naive Bayesian networks
in intrusion detection systems,’’ in Proc. 23rd Workshop Probabilistic
Graph. Models Classification, 14th Eur. Conf. Mach. Learn. (ECML) 7th
Eur. Conf. Princ. Pract. Knowl. Discovery Databases (PKDD), Cavtat-
Dubrovnik, Croatia, 2003, p. 11.
[27] A. Valdes and K. Skinner, ‘‘Adaptive, model-based monitoring for cyber
attack detection,’’ in Proc. Int. Workshop Recent Adv. Intrusion Detection.
Berlin, Germany: Springer, Oct. 2000, pp. 80–93.
[28] D.-Y. Yeung and C. Chow, ‘‘Parzen-window network intrusion detectors,’’
in Proc. 16th Int. Conf. Pattern Recognit., vol. 4, Aug. 2002, pp. 385–388.
[29] W. Li, ‘‘Using genetic algorithm for network intrusion detection,’’ in Proc.
United States Dept. Energy Cyber Secur. Group Training Conf., 2004,
pp. 24–27.
[30] L. Didaci, G. Giacinto, and F. Roli, ‘‘Ensemble learning for intrusion detec-
tion in computer networks,’’ in Proc. Workshop Mach. Learn. Methods
Appl., Siena, Italy, 2002, pp. 1–11.
[31] C. Kolias, G. Kambourakis, and M. Maragoudakis, ‘‘Swarm intelligence in
intrusion detection: A survey,’’ Comput. Secur., vol. 30, no. 8, pp. 625–642,
2011. doi: 10.1016/j.cose.2011.08.009.
[32] C. yin, Y. Zhu, J. Fei, and X. He, ‘‘A deep learning approach for intru-
sion detection using recurrent neural networks,’’ IEEE Access, vol. 5,
pp. 21954–21961, 2017.
VOLUME 7, 2019
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
[33] A. Javaid, Q. Niyaz, W. Sun, and M. Alam, ‘‘A deep learning
approach for network intrusion detection system,’’ in Proc. 9th EAI
Int. Conf. Bio-Inspired Inf. Commun. Technol. (BIONETICS), 2016,
pp. 21–26.
[34] J. Kim, J. Kim, H. L. T. Thu, and H. Kim, ‘‘Long short term
memory recurrent neural network classifier for intrusion detection,’’
in Proc.Int. Conf. Platform Technol. Service (PlatCon), Feb. 2016,
pp. 1–5.
[35] F. A. B. H. Ali and Y. Y. Len, ‘‘Development of host based intrusion
detection system for log files,’’ in Proc. IEEE Symp. Bus., Eng. Ind. Appl.
(ISBEIA), Sep. 2011, pp. 281–285.
[36] M. Topallar, M. O. Depren, E. Anarim, and K. Ciliz, ‘‘Host-based intrusion
detection by monitoring Windows registry accesses,’’ in Proc. IEEE 12th
Signal Process. Commun. Appl. Conf., Apr. 2004, pp. 728–731.
[37] E. Aghaei and G. Serpen, ‘‘Ensemble classifier for misuse detection using
N-gram feature vectors through operating system call traces,’’ Int. J.
Hybrid Intell. Syst., vol. 14, no. 3, pp. 141–154, 2017.
[38] B. Borisaniya and D. Patel, ‘‘Evaluation of modified vector space repre-
sentation using ADFA-LD and ADFA-WD datasets,’’ J. Inf. Secur., vol. 6,
no. 3, p. 250, 2015.
[39] M. Xie, J. Hu, X. Yu, and E. Chang, ‘‘Evaluating host-based anomaly
detection systems: Application of the frequency-based algorithms to
ADFA-LD,’’ in Proc. Int. Conf. Netw. Syst. Secur. Cham, Switzerland:
Springer, 2014, pp. 542–549.
[40] B. Subba, S. Biswas, and S. Karmakar, ‘‘Host based intrusion detection
system using frequency analysis of n-gram terms,’’ in Proc. IEEE Region
10 Conf. (TENCON), Nov. 2017, pp. 2006–2011.
[41] W. Haider, G. Creech, Y. Xie, and J. Hu, ‘‘Windows based data sets for
evaluation of robustness of host based intrusion detection systems (IDS)
to zero-day and stealth attacks,’’ Future Internet, vol. 8, no. 3, p. 29,
2016.
[42] G. Kim, H. Yi, J. Lee, Y. Paek, and S. Yoon. (2016). ‘‘LSTM-
based system-call language modeling and robust ensemble method for
designing host-based intrusion detection systems.’’ [Online]. Available:
https://arxiv.org/abs/1611.01726
[43] M. Kezunovic, L. Xie, and S. Grijalva, ‘‘The role of big data in improving
power system operation and protection,’’ in in Proc. IREP Symp. Bulk
Power Syst. Dyn. Control-IX Optim., Secur. Control Emerg. Power Grid
(IREP), Aug. 2013, pp. 1–9.
[44] M. Tang, M. Alazab, and Y. Luo, ‘‘Big data for cybersecurity: Vulnera-
bility disclosure trends and dependencies,’’ IEEE Trans. Big Data, to be
published. doi: 10.1109/tbdata.2017.2723570.
[45] R. Vinayakumar, P. Poornachandran, and K. P. Soman, ‘‘Scalable frame-
work for cyber threat situational awareness based on domain name systems
data analysis,’’ in Big Data in Engineering Applications (Studies in Big
Data), vol. 44, S. Roy, P. Samui, R. Deo, and S. Ntalampiras, Eds. Singa-
pore: Springer, 2018.
[46] C. D. Manning, P. Raghavan, and H. Schutze, Introduction to Informa-
tion Retrieval. Cambridge, U.K.: Cambridge Univ. Press, 2008, Ch. 20,
pp. 405–416.
[47] X. Glorot, A. Bordes, and Y. Bengio, ‘‘Deep sparse rectifier neural net-
works,’’ in Proc. 14th Int. Conf. Artif. Intell. Statist., 2011, pp. 315–323.
[48] A. L. Maas, A. Y. Hannun, and A. Y. Ng, ‘‘Rectifier nonlinearities improve
neural network acoustic models,’’ in Proc. ICML, 2013, vol. 30, no. 1,
pp. 1–3.
[49] V. Nair and G. E. Hinton, ‘‘Rectified linear units improve restricted boltz-
mann machines,’’ in Proc. 27th Int. Conf. Mach. Learn. (ICML), 2010,
pp. 807–814.
[50] M. V. Mahoney and P. K. Chan, ‘‘An analysis of the 1999 DARPA/Lincoln
Laboratory evaluation data for network anomaly detection,’’ in Recent
Advances in Intrusion Detection (Lecture Notes in Computer Science),
vol. 2820. Berlin, Germany: Springer, 2003, pp. 220–237.
[51] M. Sabhnani and G. Serpen, ‘‘Why machine learning algorithms fail in
misuse detection on KDD intrusion detection data set,’’ Intell. Data Anal.,
vol. 8, no. 4, pp. 403–415, 2004.
[52] Y. Bouzida and F. Cuppens, ‘‘Neural networks vs. decision trees for intru-
sion detection,’’ in Proc. IEEE/IST Workshop Monitoring, Attack Detection
Mitigation (MonAM), Sep. 2006, pp. 1–29.
[53] S. T. Brugger and J. Chow, ‘‘An assessment of the DARPA IDS evaluation
dataset using snort,’’ Dept. Comput. Sci., Univ. California, Davis, Davis,
CA, USA, Tech. Rep. CSE-2007-1, 2005.
[54] J. McHugh, ‘‘Testing intrusion detection systems: A critique of the 1998
and 1999 DARPA intrusion detection system evaluations as performed
by Lincoln Laboratory,’’ ACM Trans. Inf. Syst. Secur., vol. 3, no. 4,
pp. 262–294, 2000. doi: 10.1145/382912.382923.
VOLUME 7, 2019
[55] M. Tavallaee, E. Bagheri, W. Lu, and A. A. Ghorbani, ‘‘A detailed analysis
of the KDD CUP 99 data set,’’ in Proc. 2nd IEEE Symp. Comput. Intell.
Secur. Defence Appl., Jul. 2009, pp. 1–6.
[56] A. Shiravi, H. Shiravi, M. Tavallaee, and A. A. Ghorbani, ‘‘Toward
developing a systematic approach to generate benchmark datasets for
intrusion detection,’’ Comput. Secur., vol. 31, no. 3, pp. 357–374,
2012.
[57] N. Moustafa and J. Slay, ‘‘UNSW-NB15: A comprehensive data set for
network intrusion detection systems (UNSW-NB15 network data set),’’
in Proc. IEEE Mil. Commun. Inf. Syst. Conf. (MilCIS), Nov. 2015,
pp. 1–6.
[58] J. Song et al., ‘‘Statistical analysis of honeypot data and building of Kyoto
2006+ dataset for NIDS evaluation,’’ in Proc. 1st Workshop Building Anal.
Datasets Gathering Exper. Returns Secur., 2011, pp. 29–36.
[59] I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, ‘‘Toward generat-
ing a new intrusion detection dataset and intrusion traffic characteriza-
tion,’’ in Proc. 4th Int. Conf. Inf. Syst. Secur. Privacy (ICISSP), 2018,
pp. 1–8.
[60] H. Leung and S. Haykin, ‘‘The complex backpropagation algorithm,’’
IEEE Trans. Signal Process., vol. 39, no. 9, pp. 2101–2104, Sep. 1991.
[61] M. Alazab, ‘‘Profiling and classifying the behavior of malicious codes,’’
J. Syst. Softw., vol. 100, pp. 91–102, Feb. 2015.
[62] G. Creech and J. Hu, ‘‘A semantic approach to host-based intrusion detec-
tion systems using contiguousand discontiguous system call patterns,’’
IEEE Trans. Comput., vol. 63, no. 4, pp. 807–819, Apr. 2014.
[63] L. Van der Maaten and G. Hinton, ‘‘Visualizing data using t-SNE,’’
J. Mach. Learn. Res., vol. 9, pp. 2579–2605, Nov. 2008.
[64] J. O. Nehinbe, ‘‘A critical evaluation of datasets for investigating IDSs and
IPSs researches,’’ in Proc. IEEE 10th Int. Conf. Cybern. Intell. Syst. (CIS),
Sep. 2011, pp. 92–97.
[65] Z. Wang, ‘‘The applications of deep learning on traffic identification,’’
BlackHat USA, pp. 21–26, 2015.
[66] A. Gharib, I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani,
‘‘An evaluation framework for intrusion detection dataset,’’ in Proc. Int.
Conf. Inf. Sci. Secur. (ICISS), Dec. 2016, pp. 1–6.
[67] S. Ioffe and C. Szegedy, ‘‘Batch normalization: Accelerating deep network
training by reducing internal covariate shift,’’ in Proc. Int. Conf. Mach.
Learn., 2015, pp. 448–456.
[68] N. Srivastava, G. E. Hinton, A. Krizhevsky, I. Sutskever, and R. Salakhutdi-
nov, ‘‘Dropout: A simple way to prevent neural networks from overfitting,’’
J. Mach. Learn. Res., vol. 15, no. 1, pp. 1929–1958, 2014.
[69] K. Simonyan, A. Vedaldi, and A. Zisserman. (2013). ‘‘Deep inside con-
volutional networks: Visualising image classification models and saliency
maps.’’ [Online]. Available: https://arxiv.org/abs/1312.6034
[70] M. Alazab, S. Venkatraman, P. Watters, and M. Alazab, ‘‘Zero-day mal-
ware detection based on supervised learning algorithms of API call sig-
natures,’’ in Proc. 9th Australas. Data Mining Conf., vol. 121, 2011,
pp. 171–182.
[71] A. Alazab, M. Hobbs, J. Abawajy, and M. Alazab, ‘‘Using feature selection
for intrusion detection system,’’ in Proc. Int. Symp. Commun. Inf. Technol.
(ISCIT), Oct. 2012, pp. 296–301.
[72] T. Kim, B. Kang, M. Rho, S. Sezer, and E. G. Im, ‘‘A multimodal deep
learning method for Android Malware detection using various features,’’
IEEE Trans. Inf. Forensics Secur., vol. 14, no. 3, pp. 773–788, Mar. 2019.
[73] A. Saracino, D. Sgandurra, G. Dini, and F. Martinelli, ‘‘Madam: Effective
and efficient behavior-based android malware detection and prevention,’’
IEEE Trans. Dependable Secure Comput., vol. 15, no. 1, pp. 83–97,
Jan. 2018.
[74] S. Naseer et al., ‘‘Enhanced network anomaly detection based on deep
neural networks,’’ IEEE Access, vol. 6, pp. 48231–48246, 2018.
[75] N. R. Sabar, X. Yi, and A. Song, ‘‘A bi-objective hyper-heuristic sup-
port vector machines for big data cyber-security,’’ IEEE Access, vol. 6,
pp. 10421–10431, 2018.
[76] W. Wang et al., ‘‘HAST-IDS: Learning hierarchical spatial-temporal fea-
tures using deep neural networks to improve intrusion detection,’’ IEEE
Access, vol. 6, pp. 1792–1806, 2018.
[77] S. Aditham and N. Ranganathan, ‘‘A system architecture for the detection
of insider attacks in big data systems,’’ IEEE Trans. Dependable Secure
Comput., vol. 15, no. 6, pp. 974–987, Nov. 2018.
[78] M. N. Kurt, Y. Yılmaz, and X. Wang, ‘‘Real-time detection of hybrid and
stealthy cyber-attacks in smart grid,’’ IEEE Trans. Inf. Forensics Security,
vol. 14, no. 2, pp. 498–513, Feb. 2019.
[79] T. Zhang and Q. Zhu, ‘‘Distributed privacy-preserving collaborative intru-
sion detection systems for VANETs,’’ IEEE Trans. Signal Inf. Process.
Netw., vol. 4, no. 1, pp. 148–161, Mar. 2018.
41549

R. VINAYAKUMAR received the B.C.A. degree
from the JSS College of Arts, Commerce and Sci-
ences, Mysore, in 2011, and the M.C.A. degree
from Amrita Vishwa Vidyapeetham, Mysore,
in 2014. He is currently pursuing the Ph.D. degree
in computational engineering and networking with
the Amrita School of Engineering, Amrita Vishwa
Vidyapeetham, Coimbatore, India. His Ph.D. the-
sis is on the application of machine learning
(sometimes deep learning) for cyber security and
also discusses the importance of natural language processing, image process-
ing, and big data analytics for cyber security. He has published several papers
in machine learning applied to cyber security. He has participated in several
international shared tasks and organized a shared task on detecting malicious
domain names (DMD 2018) as part of SSCC’18 and ICACCI’18.
MAMOUN ALAZAB received the Ph.D. degree
in computer science from the School of Science,
Information Technology and Engineering, Feder-
ation University of Australia. He is currently an
Associate Professor with the College of Engineer-
ing, IT and Environment, Charles Darwin Univer-
sity, Australia. He is a Cyber-Security Researcher
and Practitioner with industry and academic expe-
rience. He works closely with government and
industry on many projects. He has published more
than 100 research papers. He has delivered many invited and keynote
speeches, 22 events in 2018 alone. His research interest is multidisci-
plinary that focuses on cyber security and digital forensics of computer
systems, including current and emerging issues in the cyber environment like
cyber-physical systems and the Internet of Things with a focus on cybercrime
detection and prevention. He convened and chaired more than 50 conferences
and workshops. He is an Editor on multiple Editorial Boards, including an
Associate Editor of the IEEE ACCESS (2017 Impact Factor 3.5), an Editor of
the SECURITY AND COMMUNICATION NETWORKS (2016 Impact Factor: 1.067), and
a Book Review Section Editor of the Journal of Digital Forensics, Security
and Law.
K. P. SOMAN has 25 years of research and teach-
ing experience at the Amrita School of Engineer-
ing, Coimbatore. He has around 150 publications
in national and international journals and confer-
ence proceedings. He has organized a series of
workshops and summer schools in advanced signal
processing using wavelets, kernel methods for pat-
tern classification, deep learning, and big-data ana-
lytics for industry and academia. He has authored
the books Insight Into Wavelets, Insight Into Data
Mining, Support Vector Machines and Other Kernel Methods, and Signal and
Image Processing—The Sparse Way, published by Prentice Hall, New Delhi,
and Elsevier.
41550
R. Vinayakumar et al.: Deep Learning Approach for Intelligent IDS
PRABAHARAN POORNACHANDRAN is
currently a Professor with Amrita Vishwa
Vidyapeetham. He has more than two decades
of experience in computer science and security
areas. His areas of interests are malware, critical
infrastructure security, complex binary analysis,
AI, and machine learning.
AMEER AL-NEMRAT is currently a Senior Lec-
turer (Associate Professor) with the School of
Architecture, Computing and Engineering, Uni-
versity of East London (UEL). He is the Leader
of the Professional Doctorate in IS and M.Sc.
Information Security and Computer Forensics Pro-
grams. He is also the Founder and the Director of
the Electronic Evidence Laboratory, UEL, where
he is involved in cybercrime projects with different
U.K. law enforcement agencies. His research inter-
ests include security, cybercrime, and digital forensics, where he has been
publishing research papers in peer-reviewed conferences and internationally
reputed journals.
SITALAKSHMI VENKATRAMAN received the
M.Sc. degree in mathematics and the M.Tech.
degree in computer science from IIT Madras,
Madras, in 1985 and 1987, respectively, the M.Ed.
degree from The University of Sheffield, in 2001,
and the Ph.D. degree in computer science from
the National Institute of Industrial Engineering,
in 1993. Her Ph.D. thesis was entitled Efficient
Parallel Algorithms for Pattern Recognition.
She has more than 30 years of work experience
both in industry and academics and has been developing turnkey projects for
IT industry and teaching a variety of IT courses for tertiary institutions in
India, Singapore, New Zealand, and Australia, since 2007. She is currently
the Discipline Leader and a Senior Lecturer in information technology
with Melbourne Polytechnic. She is specialized in applying efficient com-
puting models and data mining techniques for various industry problems
and recently in the e-health, e-security, and e-business domains through
collaborations with industry and universities in Australia. She has published
seven book chapters and more than 130 research papers in internationally
well-known refereed journals and conferences. She is a Senior Member
of professional societies and editorial boards of international journals and
serves as a Program Committee Member of several international conferences
every year.
VOLUME 7, 2019